Политика конфиденциальности
Finance Sugarfree Ltd
Дата последнего обновления: 06.10.2026 - версия 1.2
Дата последнего обновления: 06.10.2026 - версия 1.2
1. Введение
Finance Sugarfree Ltd (далее - «Компания», «мы», «нас», «наш») стремится защищать вашу приватность и обеспечивать безопасность ваших персональных данных. В рамках этого обязательства мы стремимся быть прозрачными в отношении того, какую информацию мы собираем, когда мы её собираем и как используем.
Настоящая Политика конфиденциальности (далее - «Политика») объясняет, как мы собираем, используем и обрабатываем персональные данные, когда вы пользуетесь нашим сайтом, нашей платформой онлайн-обучения и нашими услугами, включая любые продукты или функции, предоставляемые Компанией (далее совместно - «Услуги»). Получая доступ к Услугам или используя их, вы подтверждаете, что прочитали и поняли настоящую Политику. Если для какой-либо обработки мы опираемся на ваше согласие, мы получаем его отдельно и явно.
«Персональные данные» означают любую информацию, относящуюся к идентифицированному или идентифицируемому физическому лицу, включая данные, которые сами по себе или в сочетании с другой информацией могут быть использованы для вашей идентификации.
Настоящая Политика конфиденциальности (далее - «Политика») объясняет, как мы собираем, используем и обрабатываем персональные данные, когда вы пользуетесь нашим сайтом, нашей платформой онлайн-обучения и нашими услугами, включая любые продукты или функции, предоставляемые Компанией (далее совместно - «Услуги»). Получая доступ к Услугам или используя их, вы подтверждаете, что прочитали и поняли настоящую Политику. Если для какой-либо обработки мы опираемся на ваше согласие, мы получаем его отдельно и явно.
«Персональные данные» означают любую информацию, относящуюся к идентифицированному или идентифицируемому физическому лицу, включая данные, которые сами по себе или в сочетании с другой информацией могут быть использованы для вашей идентификации.
2. Кто контролирует ваши персональные данные и как с нами связаться
3. Персональные данные, которые мы собираем
4. Цели обработки и правовые основания
5. Автоматизированное принятие решений и профилирование
6. Передача ваших персональных данных
7. Международные передачи данных
8. Сроки хранения персональных данных
9. Безопасность данных
10. Ваши права
11. Файлы cookie
12. Изменения настоящей Политики
13. Контакты
English version - Privacy Policy
In the event of any inconsistency between language versions, the English version prevails, as set out in the Terms of Service.
PRIVACY POLICY
Finance Sugarfree Ltd
Last updated: 06.10.2026 - Version 1.2
1. Introduction
Finance Sugarfree Ltd (the “Company”, “we”, “us”, “our”) is committed to protecting your privacy and securing your personal data. As part of this commitment, we aim to be transparent about what information we collect, when we collect it, and how we use it.
This Privacy Policy (the “Policy”) explains how we collect, use and process personal data when you use our website, our online learning platform, and our services, including any products or features provided by the Company (collectively, the “Services”). By accessing or using the Services, you confirm that you have read and understood this Policy. Where we rely on your consent for any processing, we obtain it from you separately and explicitly.
“Personal Data” means any information relating to an identified or identifiable individual, including data that, alone or in combination with other information, could be used to identify you.
2. Who controls your personal data and how to contact us
The controller responsible for processing your personal data is Finance Sugarfree Ltd, registered in the Republic of Cyprus under company number HE 476071, with its registered office at Charilaou Xyloforou, 13 Agios Athanasios, 4103, Limassol, Cyprus.
If you have any question regarding the processing of your personal data, or wish to exercise your rights under applicable data protection law, you can contact us at:
Address: Charilaou Xyloforou, 13 Agios Athanasios, 4103, Limassol, Cyprus
Email: admin@investsystem.io
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. Requests from data subjects are handled at the address above.
3. Personal data we collect
This section sets out the categories of personal data we process. Where we collect personal data from sources other than you directly, we identify the origin of that data.
Contact Data. Your name, email address and, where you provide it, telephone number. Provided by you.
Account and Profile Data. The information held in your account on our learning platform, including name, email address, country or region, and your course access and progress. Provided by you and generated by our platform.
Course Test and Questionnaire Data. Your answers to the tests and questionnaires inside the Course and their results, including your answers to the risk-profile questionnaire (for example, your age, how stable your income is, the share of your capital you plan to invest and how large a fall in the value of your portfolio you can tolerate) and the resulting profile. Provided by you. We use this data only for your self-assessment in the Course (section 4) and keep it together with your other course data (section 8).
Financial Check-Up Data. Our financial check-up at https://checkup.investsystem.io runs entirely in your browser. Your answers about income and spending, loans, savings, your financial goal and investing, and the result - your stage and a 30-day plan - stay in your browser: they are not sent to us or stored by us, and they are gone when you close or reload the page. If you tap «Сохранить план себе» (save the plan) or «Отправить чекап другу» (send the check-up to a friend), the plan text or the check-up link is passed to Telegram or to the app you choose, only at your action; from then on that service processes it under its own terms. Before we start receiving check-up data, we will update this Policy. See also section 5 below.
Customer Relationship Data. Information relating to our interactions with you as a customer, including your classification within our customer records and the history of communications between us. Provided by you and generated by our systems.
Service Data. Personal data provided and generated through your use of the Services, including records of previous purchases and course access. Originates from you and from our systems.
Transaction Data. Data relating to transactions made with us, including your name, contact details, billing country, transaction details and a record of the consents you gave at checkout (their text, date and time). Card and payment credentials are collected and processed directly by our payment provider and are not stored by us.
Communication Data. Data contained in or relating to communications between you and us, including the content of messages and associated metadata. Metadata from website contact forms is generated automatically.
Technical and Usage Data. Limited technical data generated when you visit our website or platform, including IP address, browser type and version, operating system, referral source and pages viewed. This data is generated by our website host and learning platform in the course of delivering and securing the Services, and through cookies as described in our Cookie Policy. When your browser loads fonts or videos from the services named in section 6, those services also receive this data. Our website host provides us with built-in, cookieless aggregate visit statistics. Beyond that, we do not currently operate any third-party web analytics, advertising or social-media tracking technology on our website. Should we introduce any such technology, we will update this Policy and our Cookie Policy, and obtain your consent where required, before doing so.
Third-Party Data. Please do not provide us with personal data belonging to other individuals unless we have explicitly requested it.
You are not obliged to provide us with any personal data. However, in some cases, not providing certain personal data will prevent us from providing you with the Services you have requested, or from providing part of them.
3.1 Personal data of minors
Our Services are not intended for individuals under the age of 18. We do not knowingly collect or solicit personal data from minors. If you are a parent or guardian and believe that a child has provided us with personal data, please contact us so that we can delete it from our records.
4. Purposes of processing and legal bases
We process your personal data for one or more of the purposes set out in this section and on the corresponding legal basis. We will not process personal data about you unless there is a legal basis for doing so. The legal bases on which we may rely are: performance of a contract; compliance with a legal obligation; your consent; our legitimate interests or those of a third party; and, in exceptional cases, the protection of vital interests.
Operations. To operate our website and learning platform, fulfil orders, provide the Services, issue invoices and manage payments. Legal basis: performance of a contract with you, or steps taken at your request before entering into a contract; and our legitimate interest in the proper administration of our business.
Financial check-up. The check-up result is generated in your browser; we do not process your answers or result (section 3).
Self-assessment in the Course. To score the tests and questionnaires inside the Course, including the risk-profile questionnaire, and to show you the results. Legal basis: performance of a contract with you.
Relationships and communications. To manage our relationship with you, respond to enquiries, provide support and handle complaints. Legal basis: performance of a contract, and our legitimate interest in administering our business properly.
Direct marketing. To send you educational and promotional communications by email. Where required by applicable law we send such communications only on the basis of your prior consent, and you may withdraw that consent and unsubscribe at any time using the link included in every message or by contacting us. Where we are permitted to rely on a legitimate interest in relation to our existing customers and similar products or services, we will do so only in a manner consistent with applicable law and with your right to object at any time.
Publication. Where you expressly ask us to, we may publish material you have provided, such as a testimonial, on our website or channels. Legal basis: your consent, which you may withdraw at any time.
Service improvement. To understand how our Services are used and to improve them. Legal basis: our legitimate interest in monitoring and improving our business operations.
Record keeping and legal compliance. To create and maintain business records, including backups, and to comply with accounting, tax and anti-money-laundering obligations. Legal basis: compliance with a legal obligation, and our legitimate interest in efficient business operations.
Security and fraud prevention. To maintain the security of our Services, prevent fraud and mitigate criminal activity. Legal basis: our legitimate interest in protecting our website, Services, business and users.
Legal claims, insurance and risk management. To establish, exercise or defend legal claims, to obtain or maintain insurance cover, and to obtain professional advice. Legal basis: our legitimate interest in protecting and asserting our legal rights.
5. Automated decision-making and profiling
Our financial check-up places you at one of three stages based on your answers and shows a general educational plan; this calculation runs in your browser. The risk-profile questionnaire inside the Course likewise adds up the points for your answers and shows one of three profiles. These are simple, rule-based educational tools. They do not analyse or predict aspects of your economic situation beyond the answers you have given, they produce no decision about you, and they produce no legal effects and no similarly significant effects within the meaning of Article 22 of the GDPR. The result is informational only and is not a financial assessment, a creditworthiness assessment or personal advice.
We do not otherwise carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
6. Sharing your personal data
We do not sell, rent or lease your personal data to third parties for their own marketing purposes.
We share personal data with the following categories of recipient, each of which acts as a processor on our behalf under a written data processing agreement, or as an independent controller where indicated:
Online learning platform. LearnWorlds (CY) Ltd, a company registered in Cyprus, hosts our courses, manages student accounts and delivers course content. Personal data shared: account and profile data, Course test and questionnaire data, service data, transaction data, communication data.
Payment processing. Stripe, our payment service provider, processes payments, refunds and related queries, and carries out fraud prevention. Stripe acts as an independent controller in respect of certain processing. Personal data shared: name, contact details, billing country and transaction details. We do not receive or store your full card details.
Website hosting. Framer B.V., established in the Netherlands, provides the technical infrastructure for our public website. Cloudflare, Inc., established in the United States, hosts our financial check-up page at https://checkup.investsystem.io. Personal data shared: technical and usage data generated by your visit.
Email. Google (the Google Workspace service) runs our email, including the admin@investsystem.io mailbox. Personal data shared: contact data and the communication data contained in your correspondence with us.
Fonts. Our public website at https://investsystem.io loads fonts from Google’s servers (the Google Fonts service): when you open its pages, your browser requests the font files from Google. Google acts as an independent controller in respect of this processing. Personal data shared: technical data generated by your visit, including your IP address and browser details. Our learning platform serves its fonts from its own address and does not contact Google’s servers for them.
Sign-in with Google. If you choose to sign in to our learning platform with your Google account, Google confirms your identity to the platform, passes it your name, email address and Google account identifier, and learns of this sign-in. Google acts as an independent controller in respect of this processing. You can always sign in with your email address and password instead.
Legacy learning platform. Until our migration to LearnWorlds, our courses were hosted by GetCourse. That account is no longer active: we do not use the platform, enrol students on it or transfer personal data to it. Personal data relating to students who enrolled before the migration may remain with this provider, whose servers are located in the Russian Federation. Personal data concerned: account and profile data, service data, communication data. See section 7 below.
Professional advisers. Our accountants, auditors and legal advisers, where necessary and subject to their professional duties of confidentiality.
We do not currently use a third-party email marketing service provider. Before we introduce one, we will update this Policy to identify it and the location of its processing.
We may also disclose your personal data where this is necessary to comply with a legal obligation, to protect your vital interests or those of another person, or to establish, exercise or defend legal claims.
An up-to-date list of our processors is available on request at admin@investsystem.io.
Temporary: videos on our public website. Some videos on our public website at https://investsystem.io are stored in Servercore cloud storage in the Republic of Uzbekistan (address srvstatic.uz). A video loads only when you press play; your browser then connects to that server, which receives technical data: your IP address and browser details. Uzbekistan is not covered by a European Commission adequacy decision. We plan to move these videos to our website host, and this paragraph will be removed once they have moved.
7. International transfers
Our current online learning platform is operated by LearnWorlds (CY) Ltd, a provider established in the Republic of Cyprus. LearnWorlds stores platform data on Google Cloud servers, and our school on this platform runs in LearnWorlds’ Southeast Asia region, which LearnWorlds hosts in Singapore. Personal data held on the platform is therefore stored and processed outside the European Economic Area. Singapore is not covered by a European Commission adequacy decision. This transfer is governed by LearnWorlds’ data processing agreement, which forms part of LearnWorlds’ terms with us and incorporates the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). LearnWorlds also uses sub-processors, some of which are in the United States (see below).
Personal data relating to students who enrolled on our previous learning platform, GetCourse, may remain on this provider’s servers in the Russian Federation. The Russian Federation is not covered by a European Commission adequacy decision. Our account on this platform is not active: we transfer no personal data to it and enrol no students on it. If you enrolled before our migration and wish your data to be deleted from that platform, please contact us at admin@investsystem.io and we will send the provider a deletion request.
Some of our providers, including our payment provider, Google and Cloudflare, and some of LearnWorlds’ sub-processors are established in or transfer personal data to the United States. Where personal data is transferred to a country outside the European Economic Area that does not benefit from a European Commission adequacy decision, we put in place appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, certification under the EU-US Data Privacy Framework where applicable, together with technical and organisational measures such as encryption, and contractual commitments from recipients to uphold data protection standards.
You may contact us at admin@investsystem.io for further information about these transfers and about the safeguards in place, including a copy of the relevant safeguards.
8. Retention of personal data
We retain your personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. The periods set out below are our standard retention periods:
Account and course access data, including Course test and questionnaire data: retention period - For the duration of your access to the course, plus 12 months; reason - Performance of the contract and handling of post-purchase queries
Transaction and accounting records: retention period - 6 years from the end of the relevant financial year; reason - Cyprus accounting and tax legislation
Anti-money-laundering records, where applicable: retention period - 5 years from the end of the business relationship; reason - Cyprus anti-money-laundering legislation
Financial check-up answers and result: retention period - Not stored by us: the check-up runs in your browser (section 3); reason - Not applicable
Marketing contact data: retention period - Until you unsubscribe or withdraw consent, and in any event no more than 3 years from your last interaction with us; reason - Consent or legitimate interest
Correspondence and support records: retention period - 3 years from the last communication; reason - Legitimate interest
Website and platform technical logs: retention period - 12 months; reason - Legitimate interest in security
Where a longer period is required by law, or where the data is needed for the establishment, exercise or defence of legal claims, we retain the data for that longer period. Where personal data is no longer required, we securely delete or anonymise it.
9. Data security
We have implemented appropriate technical and organisational measures to protect the personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction, and to prevent its loss, misuse or alteration.
These measures include the use of encryption in transit, access controls, and the selection of providers who apply encryption at rest and recognised security standards. We limit access to your personal data to those persons who have a business need to know, who process it only on our instructions or on a lawful ground, and who are subject to a duty of confidentiality.
You acknowledge that the transmission of unencrypted, or inadequately encrypted, data over the internet is inherently insecure, and that we cannot guarantee the security of data sent over the internet. We cannot provide an absolute assurance against unauthorised access. In the event of a personal data breach, we will carry out a risk assessment and will notify the competent supervisory authority and, where required, affected individuals, in accordance with Articles 33 and 34 of the GDPR.
10. Your rights
Under the GDPR you have the rights set out below. To exercise any of them, contact us at admin@investsystem.io. We will respond within one month of receiving your request, and may extend that period by a further two months where the request is complex, in which case we will inform you. We may need to verify your identity before acting on a request.
Right of access - you have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data together with information about the purposes of processing, the recipients, the retention period, your rights, the source of the data, and whether any automated decision-making is involved.
Right to rectification - you have the right to ask us to correct inaccurate personal data and to complete incomplete personal data. We may seek to verify the accuracy of the data before rectifying it.
Right to erasure - you have the right to ask us to delete your personal data, and we will comply without undue delay where: the data is no longer necessary for the purposes for which it was collected; you have withdrawn your consent and we have no other legal ground; you have successfully exercised your right to object; the data has been processed unlawfully; or there is a legal obligation to erase it.
Right to restriction of processing - you have the right to ask us to store but not otherwise process your personal data where: its accuracy is contested, for a period enabling us to verify it; the processing is unlawful and you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected and verification of our overriding legitimate grounds is pending.
Right to data portability - where processing is based on your consent or on a contract with you and is carried out by automated means, you may ask us to provide your personal data in a structured, commonly used and machine-readable format, or to transmit it to another controller where technically feasible.
Right to object - where we process your personal data on the basis of our legitimate interests, you have the right to object on grounds relating to your particular situation. Where your data is processed for direct marketing, you have the right to object at any time, and we will stop that processing.
Right to withdraw consent - where we process your personal data on the basis of your consent, you may withdraw it at any time, and withdrawing it will be as straightforward as giving it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint - you may lodge a complaint with a data protection supervisory authority. The supervisory authority for the Company is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). If you reside in another EU member state, you may lodge a complaint with the supervisory authority of that state. We ask that you first raise the matter with us, although you are entitled to contact the authority at any time.
11. Cookies
We use cookies and similar technologies on our website and platform. Details of the categories used, their purposes, and how you can accept, reject or withdraw your consent are set out in our Cookie Policy, which forms part of this Policy.
12. Changes to this Policy
We may amend this Policy from time to time. Whenever we do so, we will publish the updated Policy on our website with a new version number and date. Where the amendments are significant, we will additionally seek to inform you by means of communication we consider reasonably appropriate. Unless stated otherwise, amendments take effect on publication of the updated Policy.
13. Contact
Finance Sugarfree Ltd, registration number HE 476071, Republic of Cyprus.
Registered address: Charilaou Xyloforou, 13 Agios Athanasios, 4103, Limassol, Cyprus
Email: admin@investsystem.io
PRIVACY POLICY
Finance Sugarfree Ltd
Last updated: 06.10.2026 - Version 1.2
1. Introduction
Finance Sugarfree Ltd (the “Company”, “we”, “us”, “our”) is committed to protecting your privacy and securing your personal data. As part of this commitment, we aim to be transparent about what information we collect, when we collect it, and how we use it.
This Privacy Policy (the “Policy”) explains how we collect, use and process personal data when you use our website, our online learning platform, and our services, including any products or features provided by the Company (collectively, the “Services”). By accessing or using the Services, you confirm that you have read and understood this Policy. Where we rely on your consent for any processing, we obtain it from you separately and explicitly.
“Personal Data” means any information relating to an identified or identifiable individual, including data that, alone or in combination with other information, could be used to identify you.
2. Who controls your personal data and how to contact us
The controller responsible for processing your personal data is Finance Sugarfree Ltd, registered in the Republic of Cyprus under company number HE 476071, with its registered office at Charilaou Xyloforou, 13 Agios Athanasios, 4103, Limassol, Cyprus.
If you have any question regarding the processing of your personal data, or wish to exercise your rights under applicable data protection law, you can contact us at:
Address: Charilaou Xyloforou, 13 Agios Athanasios, 4103, Limassol, Cyprus
Email: admin@investsystem.io
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. Requests from data subjects are handled at the address above.
3. Personal data we collect
This section sets out the categories of personal data we process. Where we collect personal data from sources other than you directly, we identify the origin of that data.
Contact Data. Your name, email address and, where you provide it, telephone number. Provided by you.
Account and Profile Data. The information held in your account on our learning platform, including name, email address, country or region, and your course access and progress. Provided by you and generated by our platform.
Course Test and Questionnaire Data. Your answers to the tests and questionnaires inside the Course and their results, including your answers to the risk-profile questionnaire (for example, your age, how stable your income is, the share of your capital you plan to invest and how large a fall in the value of your portfolio you can tolerate) and the resulting profile. Provided by you. We use this data only for your self-assessment in the Course (section 4) and keep it together with your other course data (section 8).
Financial Check-Up Data. Our financial check-up at https://checkup.investsystem.io runs entirely in your browser. Your answers about income and spending, loans, savings, your financial goal and investing, and the result - your stage and a 30-day plan - stay in your browser: they are not sent to us or stored by us, and they are gone when you close or reload the page. If you tap «Сохранить план себе» (save the plan) or «Отправить чекап другу» (send the check-up to a friend), the plan text or the check-up link is passed to Telegram or to the app you choose, only at your action; from then on that service processes it under its own terms. Before we start receiving check-up data, we will update this Policy. See also section 5 below.
Customer Relationship Data. Information relating to our interactions with you as a customer, including your classification within our customer records and the history of communications between us. Provided by you and generated by our systems.
Service Data. Personal data provided and generated through your use of the Services, including records of previous purchases and course access. Originates from you and from our systems.
Transaction Data. Data relating to transactions made with us, including your name, contact details, billing country, transaction details and a record of the consents you gave at checkout (their text, date and time). Card and payment credentials are collected and processed directly by our payment provider and are not stored by us.
Communication Data. Data contained in or relating to communications between you and us, including the content of messages and associated metadata. Metadata from website contact forms is generated automatically.
Technical and Usage Data. Limited technical data generated when you visit our website or platform, including IP address, browser type and version, operating system, referral source and pages viewed. This data is generated by our website host and learning platform in the course of delivering and securing the Services, and through cookies as described in our Cookie Policy. When your browser loads fonts or videos from the services named in section 6, those services also receive this data. Our website host provides us with built-in, cookieless aggregate visit statistics. Beyond that, we do not currently operate any third-party web analytics, advertising or social-media tracking technology on our website. Should we introduce any such technology, we will update this Policy and our Cookie Policy, and obtain your consent where required, before doing so.
Third-Party Data. Please do not provide us with personal data belonging to other individuals unless we have explicitly requested it.
You are not obliged to provide us with any personal data. However, in some cases, not providing certain personal data will prevent us from providing you with the Services you have requested, or from providing part of them.
3.1 Personal data of minors
Our Services are not intended for individuals under the age of 18. We do not knowingly collect or solicit personal data from minors. If you are a parent or guardian and believe that a child has provided us with personal data, please contact us so that we can delete it from our records.
4. Purposes of processing and legal bases
We process your personal data for one or more of the purposes set out in this section and on the corresponding legal basis. We will not process personal data about you unless there is a legal basis for doing so. The legal bases on which we may rely are: performance of a contract; compliance with a legal obligation; your consent; our legitimate interests or those of a third party; and, in exceptional cases, the protection of vital interests.
Operations. To operate our website and learning platform, fulfil orders, provide the Services, issue invoices and manage payments. Legal basis: performance of a contract with you, or steps taken at your request before entering into a contract; and our legitimate interest in the proper administration of our business.
Financial check-up. The check-up result is generated in your browser; we do not process your answers or result (section 3).
Self-assessment in the Course. To score the tests and questionnaires inside the Course, including the risk-profile questionnaire, and to show you the results. Legal basis: performance of a contract with you.
Relationships and communications. To manage our relationship with you, respond to enquiries, provide support and handle complaints. Legal basis: performance of a contract, and our legitimate interest in administering our business properly.
Direct marketing. To send you educational and promotional communications by email. Where required by applicable law we send such communications only on the basis of your prior consent, and you may withdraw that consent and unsubscribe at any time using the link included in every message or by contacting us. Where we are permitted to rely on a legitimate interest in relation to our existing customers and similar products or services, we will do so only in a manner consistent with applicable law and with your right to object at any time.
Publication. Where you expressly ask us to, we may publish material you have provided, such as a testimonial, on our website or channels. Legal basis: your consent, which you may withdraw at any time.
Service improvement. To understand how our Services are used and to improve them. Legal basis: our legitimate interest in monitoring and improving our business operations.
Record keeping and legal compliance. To create and maintain business records, including backups, and to comply with accounting, tax and anti-money-laundering obligations. Legal basis: compliance with a legal obligation, and our legitimate interest in efficient business operations.
Security and fraud prevention. To maintain the security of our Services, prevent fraud and mitigate criminal activity. Legal basis: our legitimate interest in protecting our website, Services, business and users.
Legal claims, insurance and risk management. To establish, exercise or defend legal claims, to obtain or maintain insurance cover, and to obtain professional advice. Legal basis: our legitimate interest in protecting and asserting our legal rights.
5. Automated decision-making and profiling
Our financial check-up places you at one of three stages based on your answers and shows a general educational plan; this calculation runs in your browser. The risk-profile questionnaire inside the Course likewise adds up the points for your answers and shows one of three profiles. These are simple, rule-based educational tools. They do not analyse or predict aspects of your economic situation beyond the answers you have given, they produce no decision about you, and they produce no legal effects and no similarly significant effects within the meaning of Article 22 of the GDPR. The result is informational only and is not a financial assessment, a creditworthiness assessment or personal advice.
We do not otherwise carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
6. Sharing your personal data
We do not sell, rent or lease your personal data to third parties for their own marketing purposes.
We share personal data with the following categories of recipient, each of which acts as a processor on our behalf under a written data processing agreement, or as an independent controller where indicated:
Online learning platform. LearnWorlds (CY) Ltd, a company registered in Cyprus, hosts our courses, manages student accounts and delivers course content. Personal data shared: account and profile data, Course test and questionnaire data, service data, transaction data, communication data.
Payment processing. Stripe, our payment service provider, processes payments, refunds and related queries, and carries out fraud prevention. Stripe acts as an independent controller in respect of certain processing. Personal data shared: name, contact details, billing country and transaction details. We do not receive or store your full card details.
Website hosting. Framer B.V., established in the Netherlands, provides the technical infrastructure for our public website. Cloudflare, Inc., established in the United States, hosts our financial check-up page at https://checkup.investsystem.io. Personal data shared: technical and usage data generated by your visit.
Email. Google (the Google Workspace service) runs our email, including the admin@investsystem.io mailbox. Personal data shared: contact data and the communication data contained in your correspondence with us.
Fonts. Our public website at https://investsystem.io loads fonts from Google’s servers (the Google Fonts service): when you open its pages, your browser requests the font files from Google. Google acts as an independent controller in respect of this processing. Personal data shared: technical data generated by your visit, including your IP address and browser details. Our learning platform serves its fonts from its own address and does not contact Google’s servers for them.
Sign-in with Google. If you choose to sign in to our learning platform with your Google account, Google confirms your identity to the platform, passes it your name, email address and Google account identifier, and learns of this sign-in. Google acts as an independent controller in respect of this processing. You can always sign in with your email address and password instead.
Legacy learning platform. Until our migration to LearnWorlds, our courses were hosted by GetCourse. That account is no longer active: we do not use the platform, enrol students on it or transfer personal data to it. Personal data relating to students who enrolled before the migration may remain with this provider, whose servers are located in the Russian Federation. Personal data concerned: account and profile data, service data, communication data. See section 7 below.
Professional advisers. Our accountants, auditors and legal advisers, where necessary and subject to their professional duties of confidentiality.
We do not currently use a third-party email marketing service provider. Before we introduce one, we will update this Policy to identify it and the location of its processing.
We may also disclose your personal data where this is necessary to comply with a legal obligation, to protect your vital interests or those of another person, or to establish, exercise or defend legal claims.
An up-to-date list of our processors is available on request at admin@investsystem.io.
Temporary: videos on our public website. Some videos on our public website at https://investsystem.io are stored in Servercore cloud storage in the Republic of Uzbekistan (address srvstatic.uz). A video loads only when you press play; your browser then connects to that server, which receives technical data: your IP address and browser details. Uzbekistan is not covered by a European Commission adequacy decision. We plan to move these videos to our website host, and this paragraph will be removed once they have moved.
7. International transfers
Our current online learning platform is operated by LearnWorlds (CY) Ltd, a provider established in the Republic of Cyprus. LearnWorlds stores platform data on Google Cloud servers, and our school on this platform runs in LearnWorlds’ Southeast Asia region, which LearnWorlds hosts in Singapore. Personal data held on the platform is therefore stored and processed outside the European Economic Area. Singapore is not covered by a European Commission adequacy decision. This transfer is governed by LearnWorlds’ data processing agreement, which forms part of LearnWorlds’ terms with us and incorporates the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). LearnWorlds also uses sub-processors, some of which are in the United States (see below).
Personal data relating to students who enrolled on our previous learning platform, GetCourse, may remain on this provider’s servers in the Russian Federation. The Russian Federation is not covered by a European Commission adequacy decision. Our account on this platform is not active: we transfer no personal data to it and enrol no students on it. If you enrolled before our migration and wish your data to be deleted from that platform, please contact us at admin@investsystem.io and we will send the provider a deletion request.
Some of our providers, including our payment provider, Google and Cloudflare, and some of LearnWorlds’ sub-processors are established in or transfer personal data to the United States. Where personal data is transferred to a country outside the European Economic Area that does not benefit from a European Commission adequacy decision, we put in place appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, certification under the EU-US Data Privacy Framework where applicable, together with technical and organisational measures such as encryption, and contractual commitments from recipients to uphold data protection standards.
You may contact us at admin@investsystem.io for further information about these transfers and about the safeguards in place, including a copy of the relevant safeguards.
8. Retention of personal data
We retain your personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. The periods set out below are our standard retention periods:
Account and course access data, including Course test and questionnaire data: retention period - For the duration of your access to the course, plus 12 months; reason - Performance of the contract and handling of post-purchase queries
Transaction and accounting records: retention period - 6 years from the end of the relevant financial year; reason - Cyprus accounting and tax legislation
Anti-money-laundering records, where applicable: retention period - 5 years from the end of the business relationship; reason - Cyprus anti-money-laundering legislation
Financial check-up answers and result: retention period - Not stored by us: the check-up runs in your browser (section 3); reason - Not applicable
Marketing contact data: retention period - Until you unsubscribe or withdraw consent, and in any event no more than 3 years from your last interaction with us; reason - Consent or legitimate interest
Correspondence and support records: retention period - 3 years from the last communication; reason - Legitimate interest
Website and platform technical logs: retention period - 12 months; reason - Legitimate interest in security
Where a longer period is required by law, or where the data is needed for the establishment, exercise or defence of legal claims, we retain the data for that longer period. Where personal data is no longer required, we securely delete or anonymise it.
9. Data security
We have implemented appropriate technical and organisational measures to protect the personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction, and to prevent its loss, misuse or alteration.
These measures include the use of encryption in transit, access controls, and the selection of providers who apply encryption at rest and recognised security standards. We limit access to your personal data to those persons who have a business need to know, who process it only on our instructions or on a lawful ground, and who are subject to a duty of confidentiality.
You acknowledge that the transmission of unencrypted, or inadequately encrypted, data over the internet is inherently insecure, and that we cannot guarantee the security of data sent over the internet. We cannot provide an absolute assurance against unauthorised access. In the event of a personal data breach, we will carry out a risk assessment and will notify the competent supervisory authority and, where required, affected individuals, in accordance with Articles 33 and 34 of the GDPR.
10. Your rights
Under the GDPR you have the rights set out below. To exercise any of them, contact us at admin@investsystem.io. We will respond within one month of receiving your request, and may extend that period by a further two months where the request is complex, in which case we will inform you. We may need to verify your identity before acting on a request.
Right of access - you have the right to obtain confirmation as to whether we process personal data about you and, if so, to receive a copy of that data together with information about the purposes of processing, the recipients, the retention period, your rights, the source of the data, and whether any automated decision-making is involved.
Right to rectification - you have the right to ask us to correct inaccurate personal data and to complete incomplete personal data. We may seek to verify the accuracy of the data before rectifying it.
Right to erasure - you have the right to ask us to delete your personal data, and we will comply without undue delay where: the data is no longer necessary for the purposes for which it was collected; you have withdrawn your consent and we have no other legal ground; you have successfully exercised your right to object; the data has been processed unlawfully; or there is a legal obligation to erase it.
Right to restriction of processing - you have the right to ask us to store but not otherwise process your personal data where: its accuracy is contested, for a period enabling us to verify it; the processing is unlawful and you oppose erasure; we no longer need the data but you need it for legal claims; or you have objected and verification of our overriding legitimate grounds is pending.
Right to data portability - where processing is based on your consent or on a contract with you and is carried out by automated means, you may ask us to provide your personal data in a structured, commonly used and machine-readable format, or to transmit it to another controller where technically feasible.
Right to object - where we process your personal data on the basis of our legitimate interests, you have the right to object on grounds relating to your particular situation. Where your data is processed for direct marketing, you have the right to object at any time, and we will stop that processing.
Right to withdraw consent - where we process your personal data on the basis of your consent, you may withdraw it at any time, and withdrawing it will be as straightforward as giving it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint - you may lodge a complaint with a data protection supervisory authority. The supervisory authority for the Company is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). If you reside in another EU member state, you may lodge a complaint with the supervisory authority of that state. We ask that you first raise the matter with us, although you are entitled to contact the authority at any time.
11. Cookies
We use cookies and similar technologies on our website and platform. Details of the categories used, their purposes, and how you can accept, reject or withdraw your consent are set out in our Cookie Policy, which forms part of this Policy.
12. Changes to this Policy
We may amend this Policy from time to time. Whenever we do so, we will publish the updated Policy on our website with a new version number and date. Where the amendments are significant, we will additionally seek to inform you by means of communication we consider reasonably appropriate. Unless stated otherwise, amendments take effect on publication of the updated Policy.
13. Contact
Finance Sugarfree Ltd, registration number HE 476071, Republic of Cyprus.
Registered address: Charilaou Xyloforou, 13 Agios Athanasios, 4103, Limassol, Cyprus
Email: admin@investsystem.io